#1026: Spam filtering on domain age. And ASN!

[Philip]

In #1026 Steve read a suggestion from Shaun Michelson that the age of the From: domain would make a good spam metric. (Until, of course, the spammers started pre-registering domains for use a day later than the cut-off!)

In my analysis of a spam campaign that irked me a year or two back, I found that the commonality between all the spam emails was the originating ASN.

Some means of filtering emails on that could be very effective as finding an alternative spam-friendly ASN isn’t something they’d want to do unless they had to.

 

[cschuber]

Basically what I do is,

a) Only properly registered (in DNS) hosts can connect to my SMTP port.
b) The gateway runs a Bayesian filter which flags the rest. Those flagged go into a spam folder.
c) My Postfix server also filters based on from address and subject line.
d) The few that do get through are used to train the Bayesian filter.

From domain does not work as quite a few of them come from one of my domains, gmail, or other legitimate sources.

 

[Philip]

The From: address and its domain is the easiest thing in the world to spoof, so from a superficial glance, spam can easily appear to come from Gmail.

Take a look at the full headers and find the earliest with a public (non RFC1918) IP address, e.g.
Received: from mossane.bond (ocolas.lat [51.195.235.232])
by mail.konnecen.casa (Postfix) with ESMTPA id 85EAE663D2;
Fri, 17 Jan 2025 03:06:23 +0200 (EET)

IP to ASN look-up on 194.39.204.19 reveals that it belongs to AS16276. This is the same as a significant number of other spam emails which otherwise have nothing definite in common.

You'll probably find that most of your spam comes from just a handful of spammy ASNs.